Privacy policy

Effective 31 October 2026. Last updated 31 October 2026.

1. Who we are

Tarko Report ("Tarko", "we", "us") is a reporting service for ecommerce brands, run by Webtalez Digital, a sole proprietorship of Dhruven Prasannbhai Turakhia registered in Maharashtra, India. This policy covers the website at tarko.report, the Tarko Report web app, and the Tarko Report app inside Shopify admin.

We use these terms below. The brand is the business that connects its store and ad accounts. A seat holder is a person the brand gives access to Tarko. A shopper is a customer of the brand's store.

2. Our role for your data

• For data we pull from a brand's Shopify store, ad accounts, Google Analytics and Merchant Center, we act on the brand's behalf and on its instructions (a "data processor" under India's Digital Personal Data Protection Act, 2023, and other data protection laws). The brand decides which accounts to connect and who can see the reports.
• For seat holders' own account details (such as email address and login activity), we decide how that data is used, as described here.

3. What we collect, by source

We connect only to accounts that a brand's authorised user connects, and we ask for read-only access wherever the platform offers it. Where a platform's permission also allows changes, we only read.

Shopify

When a brand installs Tarko from Shopify, we read:

• Orders and refunds: order number, dates, line items, quantities, prices, discounts, taxes, shipping charges, payment gateway name, tags, cancellation and refund details, and the order's landing page, referrer and UTM tags (from Shopify's customer journey summary).
• Products and inventory: products, variants, SKUs, prices, cost per item where the brand has entered it, and stock levels by location.
• Shopper location, pseudonymised: from each order's shipping address we keep only the city, state or province, postal code (pincode) and country. Shoppers are identified only by a pseudonymous key: a one-way hash of the Shopify customer ID with a secret value, so it cannot be reversed into the original ID.
• Store details: store name, domain, time zone, currency and plan, and the access token Shopify issues to the app.

Meta (Facebook and Instagram ads)

When a brand connects Meta through Facebook Login for Business, with the ads_read permission we read, for the ad accounts the brand selects: account, campaign, ad set and ad names, IDs, status, budgets and settings; ad creative details (format, launch date, landing page URL, preview); and performance insights such as spend, impressions, reach, clicks and platform-reported purchases and purchase value, including breakdowns by placement, age group, gender and region. These breakdowns are aggregated by Meta and do not identify individuals.

Google Ads

When a brand connects Google, with the Google Ads scope we read, for the Google Ads accounts the brand selects: account, campaign, ad group and ad structure and status; and performance reports including spend, impressions, clicks, conversions and conversion value, by campaign type, search term, device, location and landing page. We never create, change or pause campaigns, budgets or ads.

Google Analytics 4

With the read-only Google Analytics scope, we list the GA4 properties the user can access so the brand can pick one, and then read aggregated daily reports for that property: sessions, engaged sessions, add-to-carts and other events, by landing page, source, medium, campaign, default channel group and device. GA4 reports are aggregated and do not identify individual visitors. We do not read user-level or user-ID data.

Google Merchant Center

With the Merchant Center scope, through the Merchant API, we read for the account the brand selects: account-level issues and warnings, product approval status by destination and country, item-level issues for disapproved products (product ID, title and the issue), and the product performance report (clicks and impressions by product and destination). We never change products, feeds or account settings.

Page speed

For the brand's most-visited public landing pages, we request publicly available speed data from Google's PageSpeed Insights service (Chrome real-user data). Only the public page URL is sent. No login is involved.

Seat holders

• Account details: email address, and a name if you add one; your role (Owner, CXO view or Team view) and the store you belong to.
• Sign-in: if you sign in with a one-time email link, we store a hashed, short-lived token. If you sign in with Google, we receive your Google account's email address, name and profile picture (the openid, email and profile scopes) and use them only to sign you in.
• Preferences: settings such as your home tiles, digest and alert choices, and web push subscription details for your devices.
• Usage and technical data: pages and features used, sign-in times, IP address, browser and device type, and error reports, used to keep the service secure and working and to improve it.

Website visitors and enquiries

This website has no advertising trackers or analytics. If you email us, we keep the email and your contact details to reply.

4. What we never collect

• We do not request or store shoppers' names, email addresses, phone numbers or street address lines. We do not ask Shopify for access to those fields.
• We do not collect payment card or bank details. Charges for Tarko are billed by Shopify.
• We do not read user-level visitor data from Google Analytics or personal profiles from Meta.

5. How we use data

We use data only to provide and improve the features a brand uses:

• to calculate and show the brand's reports, alerts, daily email digest and web push notifications to the brand's seat holders;
• to check data accuracy (for example, matching our totals against Shopify and the ad platforms) and to show how fresh each source is;
• to manage seats, roles and billing through Shopify;
• to secure the service, prevent abuse, and fix errors;
• to answer support requests; and
• to meet legal obligations.

We do not sell data. We do not use any brand's data for advertising, to build profiles of shoppers, or to benefit any other brand. One brand's data is never shown to another brand.

6. Google user data and Limited Use

In particular, for data we receive from Google Ads, Google Analytics, Google Merchant Center and Google sign-in:

• we use it only to provide and improve the user-facing reporting features described in this policy and visible in the app;
• we transfer it to others only when needed to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users;
• we do not use or transfer it for serving advertisements, including retargeting, personalised or interest-based advertising;
• we do not sell it, and do not use it to determine creditworthiness or for lending;
• we do not use it to develop, improve or train generalised artificial intelligence or machine learning models;
• no person at Tarko reads it unless the brand gives us permission for specific data (for example, to answer a support request), it is necessary for security purposes (such as investigating abuse), it is needed to comply with law, or it is aggregated and anonymised for internal operations.

You can remove Tarko's access to your Google account at any time from your Google Account permissions page, or by disconnecting Google in Tarko's settings.

7. Meta data

We use data from Meta's APIs in line with the Meta Platform Terms and Developer Policies, only to show the brand's own advertising reports to its seat holders. We do not sell it, use it for advertising, or share it with data brokers. You can remove Tarko's access from your Facebook Business Integrations settings or by disconnecting Meta in Tarko. To have your Meta data deleted, see Disconnecting and deleting data.

8. Shopify data

We follow Shopify's API terms and its requirements for protected customer data. We support Shopify's privacy requests: when a shopper asks a brand for their data, or asks for it to be deleted, Shopify notifies us and we respond for the pseudonymous records we hold. When a brand uninstalls Tarko, Shopify notifies us and we delete that store's data as described in Retention.

9. Where data is stored

We store brand data and seat-holder account data in a database in Mumbai, India, and run the application that processes it in the same region. Some of the service providers listed below process limited data outside India (for example, to deliver email or to report errors). Where that happens, we limit what is sent to what the provider needs.

10. Service providers

We use these providers to run Tarko. Each is bound by contract to use data only to provide its service to us.

We may also disclose data if required by law, to protect the rights and safety of our users or the public, or as part of a business transfer, in which case this policy continues to apply to the data transferred.

11. Security

• Access tokens for Shopify, Meta and Google are encrypted at rest with AES-256 and are never shown in the app, logs or emails.
• All connections use HTTPS (TLS). The database is encrypted at rest.
• Seat holders see only the stores the store owner has given them a seat on, with permissions based on their role.
• Only the people who operate Tarko can reach production systems, with two-factor authentication, and only when needed.
• We ask for the fewest permissions that the features need.

No system is perfectly secure. If a breach affects your data, we will tell affected brands and the authorities as the law requires.

12. Retention

• While connected: we keep a brand's data while its account is active, so it can see history and trends.
• Disconnecting a source (Meta, Google, or a Google service): we delete that source's access token at once, stop all syncs, and delete the data pulled from that source within 30 days.
• Uninstalling from Shopify: we stop syncing at once and delete all of that store's data, including its tokens, seats and reports, within 30 days.
• Removed seat holders: we delete the person's account details within 30 days, unless they still hold a seat on another store.
• Backups and logs: deleted data may remain in encrypted database backups until they expire, within 30 days. Error logs are kept for up to 90 days.

13. Disconnecting and deleting data

• In the app: a store Owner can disconnect Meta or Google under Settings, Connections. This deletes the token immediately and the source's data within 30 days.
• At the platform: removing Tarko from your Google Account permissions, Facebook Business Integrations, or uninstalling it from Shopify admin has the same effect once we detect it.
• By email: write to hello@tarko.report with the subject "Data deletion request", the store domain, and which data you want deleted. We confirm when it is done, within 30 days.

14. Your rights

Depending on where you live, including under India's Digital Personal Data Protection Act, 2023 and the EU and UK GDPR, you may have the right to know what personal data we hold about you, to correct or delete it, to withdraw consent, to object to or restrict some uses, to nominate someone to exercise your rights, and to complain to a data protection authority. Seat holders can write to us to use these rights.

Shoppers: Tarko holds only pseudonymous data on behalf of the store you bought from. Please contact that store; we act on its instructions and on the privacy requests Shopify sends us.

15. Cookies

This website sets no cookies. The Tarko app uses cookies and local storage that are needed to keep you signed in and to remember your preferences (such as dark or light theme). Inside the app, product analytics records which features are used, linked to a pseudonymous user ID.

16. Children

Tarko is a business tool and is not meant for anyone under 18. We do not knowingly collect data about children.

17. Changes to this policy

If we change this policy, we will post the new version here with a new date. If a change materially affects how we use data already collected, we will tell store Owners by email before it takes effect.

18. Contact and grievance officer

Webtalez Digital, Maharashtra, India.
Grievance officer: Dhruven Turakhia
Email: hello@tarko.report

We acknowledge privacy requests and complaints within 7 days and aim to resolve them within 30 days.